Youtube Free Youtube Video

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:38 PM UTC
• Version:
  1.0.0

Overview

This skill is a disclosed remote YouTube video editor, but users should know it sends video links/files and prompts to NemoVideo and can auto-start a remote session.

Install this only if you are comfortable sending video links, selected media files, and editing instructions to NemoVideo. Avoid private or confidential videos unless you trust that provider, use a dedicated token if possible, and give explicit instructions before upload/export to avoid accidental remote processing.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The routing rule sends 'everything else' to the SSE action, which makes this skill activate on nearly any user request once invoked. In a skill that can upload URLs, create remote sessions, and trigger cloud-side processing, such a broad fallback increases the chance of unintended API calls and overbroad handling of unrelated prompts.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The example invocation guidance includes broad everyday-language phrases like 'edit my YouTube video links,' which can match natural conversation and unintentionally trigger the skill. While not directly exploitable for code execution, this can cause accidental activation of networked actions and processing against third-party services without sufficiently explicit user intent.

VirusTotal

65/65 vendors flagged this skill as clean.